# Openvpn vulnerabilities Source: https://junglewise.ai/threats/vendors/openvpn Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/openvpn.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 21 vulnerabilities in Openvpn: 0 in the last 7 days and 15 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115402, was published on 28 October 2026. 6 vulnerabilities in the last four weeks, up from none in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 15 - All time: 21 (0 critical, 0 exploited in the wild) ## About Openvpn An open-source project that provides virtual private network (VPN) solutions to create secure point-to-point or site-to-site connections. ## Latest Openvpn vulnerabilities - [CVE-2026-115402: OpenVPN ovpn-dco-win race condition denial of service](https://junglewise.ai/threats/cve-2026-115402-openvpn-ovpn-dco-win-0-6-5-through-2-8-13-allows-unprivileged) (info, published 28 Oct 2026) - [CVE-2026-106017: OpenVPN 3 Core certificate validation bypass in extended key usage](https://junglewise.ai/threats/cve-2026-106017-improper-certificate-validation-in-the-openvpn-3-core-library) (info, published 22 Oct 2026) - [CVE-2026-84471: OpenVPN use-after-free in TLS session promotion or expiry](https://junglewise.ai/threats/cve-2026-84471-the-fix-for-was-incomplete-a-use-after-free-in-openvpn-2-6-0) (info, published 14 Oct 2026) - [CVE-2026-88964: OpenVPN integer underflow in domain search options](https://junglewise.ai/threats/cve-2026-88964-an-integer-underflow-in-openvpn-version-2-7-alpha3-through-2-7-7) (info, published 13 Oct 2026) - [CVE-2026-105390: OpenVPN ovpn-dco-win synchronization deadlock](https://junglewise.ai/threats/cve-2026-105390-improper-synchronization-in-the-openvpn-ovpn-dco-win-for-windows) (info, published 13 Oct 2026) - [CVE-2026-84790: OpenVPN identity impersonation via embedded NUL in certificate subject](https://junglewise.ai/threats/cve-2026-84790-openvpn-2-7-alpha1-through-2-7-7-allows-remote-authenticated) (info, published 13 Oct 2026) - [CVE-2026-82325: OpenVPN ovpn-dco-win use-after-free in driver](https://junglewise.ai/threats/cve-2026-82325-openvpn-ovpn-dco-win-use-after-free-in-driver) (info, published 7 Sep 2026) - [CVE-2026-84732: OpenVPN ACK packet retransmission denial of service](https://junglewise.ai/threats/cve-2026-84732-openvpn-ack-packet-retransmission-denial-of-service) (info, published 7 Sep 2026) - [CVE-2026-84256: OpenVPN argument parsing vulnerability on Windows](https://junglewise.ai/threats/cve-2026-84256-openvpn-argument-parsing-vulnerability-on-windows) (info, CVSS 0, published 7 Sep 2026) - [CVE-2026-84226: OpenVPN binary planting on Windows](https://junglewise.ai/threats/cve-2026-84226-openvpn-binary-planting-on-windows) (info, published 7 Sep 2026) - [CVE-2026-82312: OpenVPN denial of service via NULL DACL on Windows IPC](https://junglewise.ai/threats/cve-2026-82312-openvpn-denial-of-service-via-null-dacl-on-windows-ipc) (info, published 7 Sep 2026) - [CVE-2026-81830: OpenVPN Windows interactive service path validation bypass](https://junglewise.ai/threats/cve-2026-81830-openvpn-windows-interactive-service-path-validation-bypass) (info, published 7 Sep 2026) - [CVE-2026-81738: OpenVPN out-of-bounds write in tap-windows6 driver](https://junglewise.ai/threats/cve-2026-81738-openvpn-out-of-bounds-write-in-tap-windows6-driver) (info, published 7 Sep 2026) - [CVE-2026-78221: OpenVPN Windows Interactive Service buffer size miscalculation](https://junglewise.ai/threats/cve-2026-78221-openvpn-windows-interactive-service-buffer-size-miscalculation) (info, published 7 Sep 2026) - [CVE-2026-78043: OpenVPN Windows Interactive Service configuration bypass](https://junglewise.ai/threats/cve-2026-78043-openvpn-windows-interactive-service-configuration-bypass) (info, published 7 Sep 2026) - [CVE-2026-63650: OpenVPN authentication identity lookup bypass in mbedTLS](https://junglewise.ai/threats/cve-2026-63650-openvpn-authentication-identity-lookup-bypass-in-mbedtls) (info, published 14 Aug 2026) - [CVE-2026-63649: OpenVPN Windows interactive service configuration bypass](https://junglewise.ai/threats/cve-2026-63649-openvpn-windows-interactive-service-configuration-bypass) (info, published 14 Aug 2026) - [CVE-2026-12932: OpenVPN memory leak in tls-crypt-v2 client key extraction](https://junglewise.ai/threats/cve-2026-12932-openvpn-memory-leak-in-tls-crypt-v2-client-key-extraction) (info, CVSS 7.1, published 30 Jul 2026) - [CVE-2026-11771: OpenVPN off-by-one buffer write in NTLM proxy authentication](https://junglewise.ai/threats/cve-2026-11771-openvpn-off-by-one-buffer-write-in-ntlm-proxy-authentication) (info, CVSS 7, published 30 Jul 2026) - [CVE-2025-3110: OpenVPN Access Server HTTP request smuggling via bare line-feed sequences](https://junglewise.ai/threats/cve-2025-3110-openvpn-access-server-http-request-smuggling-via-bare-line-feed) (info, CVSS 6.9, published 8 Jul 2026) - [CVE-2026-11604: OpenVPN ovpn-dco-win heap overflow in epoch key generator](https://junglewise.ai/threats/cve-2026-11604-openvpn-ovpn-dco-win-heap-overflow-in-epoch-key-generator) (info, CVSS 5.6, published 10 Jun 2026) ## Most severe Openvpn vulnerabilities - [CVE-2026-12932: OpenVPN memory leak in tls-crypt-v2 client key extraction](https://junglewise.ai/threats/cve-2026-12932-openvpn-memory-leak-in-tls-crypt-v2-client-key-extraction) (info, CVSS 7.1, published 30 Jul 2026) - [CVE-2026-11771: OpenVPN off-by-one buffer write in NTLM proxy authentication](https://junglewise.ai/threats/cve-2026-11771-openvpn-off-by-one-buffer-write-in-ntlm-proxy-authentication) (info, CVSS 7, published 30 Jul 2026) - [CVE-2025-3110: OpenVPN Access Server HTTP request smuggling via bare line-feed sequences](https://junglewise.ai/threats/cve-2025-3110-openvpn-access-server-http-request-smuggling-via-bare-line-feed) (info, CVSS 6.9, published 8 Jul 2026) - [CVE-2026-11604: OpenVPN ovpn-dco-win heap overflow in epoch key generator](https://junglewise.ai/threats/cve-2026-11604-openvpn-ovpn-dco-win-heap-overflow-in-epoch-key-generator) (info, CVSS 5.6, published 10 Jun 2026) - [CVE-2026-84256: OpenVPN argument parsing vulnerability on Windows](https://junglewise.ai/threats/cve-2026-84256-openvpn-argument-parsing-vulnerability-on-windows) (info, CVSS 0, published 7 Sep 2026) - [CVE-2026-84732: OpenVPN ACK packet retransmission denial of service](https://junglewise.ai/threats/cve-2026-84732-openvpn-ack-packet-retransmission-denial-of-service) (info, published 7 Sep 2026) - [CVE-2026-88964: OpenVPN integer underflow in domain search options](https://junglewise.ai/threats/cve-2026-88964-an-integer-underflow-in-openvpn-version-2-7-alpha3-through-2-7-7) (info, published 13 Oct 2026) - [CVE-2026-84471: OpenVPN use-after-free in TLS session promotion or expiry](https://junglewise.ai/threats/cve-2026-84471-the-fix-for-was-incomplete-a-use-after-free-in-openvpn-2-6-0) (info, published 14 Oct 2026) - [CVE-2026-63650: OpenVPN authentication identity lookup bypass in mbedTLS](https://junglewise.ai/threats/cve-2026-63650-openvpn-authentication-identity-lookup-bypass-in-mbedtls) (info, published 14 Aug 2026) - [CVE-2026-81738: OpenVPN out-of-bounds write in tap-windows6 driver](https://junglewise.ai/threats/cve-2026-81738-openvpn-out-of-bounds-write-in-tap-windows6-driver) (info, published 7 Sep 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 9 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Openvpn technologies - [OpenVPN](https://junglewise.ai/threats/technologies/openvpn): 22 vulnerabilities - [Openvpn Ovpn-Dco-Win](https://junglewise.ai/threats/technologies/ovpn-dco-win): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Openvpn vulnerabilities", https://junglewise.ai/threats/vendors/openvpn, 13 November 2026.